Vulnerabilities / Threats
7/8/2009
02:37 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Web Link Shrinkage Powers Spam Surge

The popularity of Twitter has lead to a proliferation of URL shortening services. Now spammers are taking notice and using link reduction to hide spam links.

Concerns raised in April about the security implications of Web link shortening services have proven to be well-founded: The presence of shortened URLs in spam messages has surged in the past week.

Shortened URLs now appear in more than 2% of spam messages, according to MessageLabs. Matt Sergeant, senior anti-spam technologist at the security company, attributes the spike to the development of automated tools for submitting Web links to URL shortening services.

"These services definitely do have a problem with spam links," he said. "What we haven't seen before is the large scale use of URL shortening services in e-mail spam."

Rising usage of sites like Facebook and Twitter, which offer limited-length messaging, has led more people to use services like TinyURL and bit.ly to shrink sprawling online links to a short string of characters. And with usage, investors have followed, allowing bit.ly to raise $2 million in March.

The possibility that these services may someday generate real revenue by serving as middle men between online publishers and Internet users has undeniable business appeal. But the middle man model can be subverted so that it's essentially a man-in-the-middle attack.

A man-in-the-middle attack typically refers to a communications scenario where an attacker relays messages between two parties without their knowledge. Though URL shortening services don't operate covertly, the users of such services may conceal their intent and those clicking on links disguised by such services often don't consider the implications.

"It really breaks down the whole trust model of the URL," said Sergeant. "When you look at a URL you can see, for example, that it points to the New York Times Web site. With these you have no idea where you end up."

Del.icio.us founder Joshua Schachter, now a Google employee, published a blog post in April summarizing several problems surrounding URL shortening services. Beyond issues of poor usability, search rank damage for publishers, and diminished navigability over time, he confirmed that URL shortening services are popular with spammers.

"[A] link that used to be transparent is now opaque and requires a lookup operation," he said. "From my past experience with Del.icio.us, I know that a huge proportion of shortened links are just a disguise for spam, so examining the expanded URL is a necessary step."

Sergeant blames Twitter in part because the service insists on a 140 character limit to accommodate mobile phone messaging conventions. "I personally think the 140 character restriction is a bit ridiculous," he said. "Twitter is partly responsible for this problem. You just can't fit URLs in that space."

Twitter could fetch site names from URLs submitted by users and replace the display text of Twittered links with the destination domain. But doing so would require a lot of behind-the-scenes Web queries, which might require more computing power than the company wants to deploy to address the issue.

Until a technical solution emerges, short URLs are likely to remain risky.

"It's an ongoing problem and it's certainly not going to go away any time soon," said Sergeant.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio